8eb90db1998a2e8dfcc611e4a8c747728f4ab1a13f9961bb03c5d25127096a53

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 01:42

Target

8eb90db1998a2e8dfcc611e4a8c747728f4ab1a13f9961bb03c5d25127096a53.dll
Size

280KB
MD5

3d15f684f503f538769192c4c38c2962
SHA1

bc69d6d8ab5e3db6c01db76094ad0b329bdcc9a4
SHA256

8eb90db1998a2e8dfcc611e4a8c747728f4ab1a13f9961bb03c5d25127096a53
SHA512

6c090eae5d938ac0f231ab9200f3f1e825ef348b02949397b8a655554a0077fd0dc311d13d92a27730e7bc8788865fc4d209e1bb80b80eafc53c8b9890ed22e7
SSDEEP

6144:/Rt8Kmq5tgHvZvzNm5gV3cgqfJ9zvuwRNvpcjte1:Jt88gPHm5gZcgqfrzvpuQ1

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28
PID 832 wrote to memory of 1204	832	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8eb90db1998a2e8dfcc611e4a8c747728f4ab1a13f9961bb03c5d25127096a53.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8eb90db1998a2e8dfcc611e4a8c747728f4ab1a13f9961bb03c5d25127096a53.dll,#1
  2⤵
  PID:1204

memory/1204-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download